How to disable Lfd excessive resource usage alert

LFD : is the abbreviation of Login Failure Daemon. It is a daemon process running on a server which has CSF for server security. LFD scans the server logs files periodically (every X seconds) for resent login failures and consider such attempts like “Brute Force Attacks” and block that IPs with the help of CSF.

LFD also send emails from server for excessive resource usage. In LFD we can set different resource usage limits.

From the above email example you can see that, here the alert is for excessive memory usage from the server for a particular user. You can avoid this email alert by different ways.

Method I

You can disable this particular feature from CSF configuration. That’s not a good method to solve this issue. This email alert is actually much useful for monitoring user’s resource usage under your server.

How to disable it?

Step 1: Login to your server via SSH as root user.

Step 2: Open the CSF configuration file (/etc/csf/csf.conf) with your favorite editor and search the directive ‘PT_USERMEM‘. By considering the above example, the PT_USERMEM is 200.

You can set the value of PT_USERMEM to ‘0’ to disable this feature from CSF.

Method II

You can increase the PT_USERMEM limit. By setting the value of PT_USERMEM to a higher value than 200 may help you.

Method III

This is the simplest and standard way to stop such alerts from CSF and LFD. There is a file in csf directory ‘csf.pignore‘. You can add the process or the user which you want to ignore this type of alert in to this file.

Very useful post. However did spend quite some time because changes were not taking effect. In my case I had restart lfd service as well in order to stop the high resource e-mails coming; type “service lfd restart” in linux without quotes. PS. I went for method II, and set up 400 MB limit.

Hello,
The problem is even you increase PT_USERMEM after a few days the emails will came back again and the virtual memory will need more. This solution it is not good. maybe it is another way to resolve this Excessive resource usage.